CVE-2025-24902
Published: 03 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-24902 is a SQL injection vulnerability (CWE-89) affecting the WeGIA application, an open-source web manager for charitable institutions. The issue resides in the `salvar_cargo.php` endpoint, where insufficient input validation allows arbitrary SQL query execution. It impacts versions of WeGIA prior to 3.2.12 and carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
An authorized attacker with low privileges (PR:L) can exploit this vulnerability remotely over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Exploitation enables execution of arbitrary SQL queries, potentially allowing the attacker to access or delete sensitive information stored in the application's database.
The vulnerability has been fixed in WeGIA version 3.2.12, and all users are advised to upgrade promptly, as no workarounds are available. Additional details are provided in the GitHub security advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pg73-w9vx-8mgp and the patching commit at https://github.com/LabRedesCefetRJ/WeGIA/commit/f535e873a8f26fe413d21f22e3eacc8c79b2fa7f.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The SQL injection vulnerability in the publicly accessible WeGIA web application directly enables remote exploitation of a public-facing application to execute arbitrary queries and impact the database.